Just one. That’s all it takes. One enforcement action, one breach, one lawsuit. Privacy and data security law is fast-moving with enormous downside risk, requiring constant vigilance to protect your organizations and your clients. Map your strategy with Bloomberg Law’s essential news, expert analysis, and practice tools. From risk mitigation and compliance challenges to legislative initiatives impacting how companies do business, Bloomberg Law closely tracks today’s shifting policy landscape to deliver actionable intelligence for law firms and corporate counsel. Save hours of research time. Automatically generate state-by-state comparisons of data breach notice requirements for more than 20 subtopics across all 50 states. Precise answers for what you need to know. Rely on our FAQs about recently enacted consumer privacy legislation in the EU, Calif., Colo., and Va. with data collection and management Practical Guidance. Save valuable time with In Focus: Virginia Privacy, our all-in-one resource on the VCDPA, including the latest news, analysis, Practical Guidance, and additional resources interpreting the impact of the new law. Today’s tech-driven world has opened the floodgates to unprecedented flows of information and communication. However, with increased connectivity and a lack of regulation, data security risks loom over businesses and consumers. As data breaches and cyberattacks become more common, there is a growing concern about how personal information is being used, processed, and stored by businesses and organizations. Consumers provide companies with a great deal of personal information, including sensitive data about their finances, health, and other records that can expose them to identity theft and fraud. Oftentimes, consumers don’t fully understand how companies will use their information or if they’ll share it with others. Consumers may be unaware that they have certain rights regarding the use of their information. Legislators around the world are trying to keep pace with new and emerging cyber threats and vulnerabilities to ensure privacy rights are safeguarded. Europe and the U.S. are paving the way toward stronger data regulation and oversight. In 2018, the EU passed the General Data Protection Regulation (GDPR), which is a key piece of legislation that regulates the collection and management of data. The U.S., on the other hand, has a handful of federal laws that protect privacy in certain contexts, such as the Privacy Act of 1974, the Health Insurance Portability and Accountability Act (HIPAA), the Children’s Online Privacy Protection Act (COPPA), among a few others. But unlike the EU, currently there is no comprehensive federal law that protects data and privacy in the U.S. Instead, a patchwork of state laws has provided varying degrees of protection to consumer data and privacy information. Privacy professionals are facing heavier workloads and an expanding list of responsibilities to keep up with this increased scrutiny and complicated compliance requirements. Vertical privacy laws protect medical records and financial data (such as an individual’s health and financial status). Horizontal privacy laws focus on how organizations use sensitive consumer information (such as biometric data and fingerprints) or other personally identifiable information (such as names and addresses). Both types of laws are important tools in legislative efforts to protect privacy rights. Vertical privacy policies can be an effective way to target risks to specific types of consumer data, while horizontal privacy regulations apply more generally to the processing of all personal data across technologies and industries. Not all PI is PII. However, all PII is PI, since PI is considered a broad category of personal identity. Data privacy policies are an important tool that can help businesses stay compliant. A data privacy policy informs consumers how a business will collect, use, store, share, and transfer personal information. These policies also allow companies to garner goodwill and trust from consumers by emphasizing the companies’ respect for consumer privacy and transparency about their practices. The U.S. does not yet have a comprehensive federal consumer data protection law that covers all varieties of private data. But it does have several federal laws that protect specific data sets, such as the U.S. Privacy Act of 1974, HIPAA, COPPA, and the Gramm-Leach-Bliley Act. As processing and storing data becomes even more essential to businesses, consumers can anticipate more states – and potentially the federal government – will pass comprehensive data privacy laws. The Privacy Act of 1974 establishes rules for collecting, maintaining, using, and disseminating personal information by all federal agencies. Individuals have the right to know what information is being collected, how that data is being utilized, and the ability to request corrections. HIPAA protects a person’s medical records by setting national standards for privacy, confidentiality, and consent. COPPA regulates how personal information is collected from children under the age of 13. Online operators must get parental consent, disclose how the information is handled, and allow a child’s guardian to access or delete the information under COPPA. The Gramm-Leach-Bliley Act, enacted in 1999, allows commercial and investment banks, securities firms, and insurance companies to consolidate, in addition to protecting the privacy of consumers’ financial information. More than a dozen states have enacted comprehensive consumer data privacy laws. And with several privacy bills currently on statehouse dockets, that list is growing. California led the charge in being the first state to enact comprehensive data privacy legislation via the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). CCPA, signed into law on June 8, 2018, and which went into effect on Jan. 1, 2020, establishes privacy rights and business requirements for collecting and selling Californians’ personal information. On Nov. 3, 2020, California voters approved the CPRA, which amended and expanded the CCPA. The CPRA took effect on Dec. 16, 2020 – although most of its CCPA revisions didn’t take effect until Jan. 1, 2023. The CPA protects information that can be linked to an identifiable individual and excludes de-identifiable data and publicly available data. Connecticut became the fifth state to implement comprehensive consumer privacy legislation on May 10, 2022. The Connecticut Data Privacy Act (CTDPA), effective as of July 1, 2023, includes stronger data protections for children but a similar framework as its predecessors. Delaware became the 12th state to join the data privacy race, giving consumers more control over how their data is processed and stored. Effective Jan. 1, 2025, the Delaware Personal Data Privacy Act has stronger privacy rights for consumers, such as heightening protections for children’s data, broadening definitions of sensitive data, and being able to opt out of the processing of personal data for targeted advertising purposes. Florida’s SB 262 created the Florida Digital Bill of Rights, which grants residents certain protections relating to the processing of their personal data by businesses, similar to provisions used by other states like Texas and California. The law also requires search engines, such as Google, to disclose if they prioritize results based on political ideology and prohibits government-mandated content moderation on social media. Florida’s law only regulates companies that make more than $1 billion in gross annual revenues and derive more than half their revenue from online ads. Most provisions go into effect July 1, 2024. Indiana is the seventh state to pass comprehensive legislation that regulates how consumer data is collected and secured. The Indiana Consumer Data Protection Act will regulate businesses that process the personal data of at least 100,000 Indiana residents, or those that handle the information of at least 25,000 state consumers but derive more than 50% of their revenue from selling data. It will take effect on Jan. 1, 2026. The sixth state to sign comprehensive data protections into law, Iowa’s Consumer Data Protection Act (ICDPA) is considered one of the most business-friendly so far, which privacy advocates say results in weaker data protections. Slated to go in effect Jan. 1, 2025, Iowa’s law does not grant consumers the right to delete or correct data collected by third parties. Modeled after Connecticut’s privacy law, Montana’s Consumer Data Privacy Act limits the collection of personal data to only “adequate, relevant, and reasonably necessary” information. Residents have the right to opt-out or decline the sale of their personal data. This law is set to go into effect Oct. 1, 2024. The New Jersey Data Privacy Act (NJDPA) provides New Jersey residents with comprehensive privacy protections against how companies collect and use their personal information. The law applies to entities that do business in the state and handle the personal data of at least 100,000 consumers per year, or at least 25,000 if the company also sells personal data. NJDPA will take effect on Jan. 15, 2025. One of the strongest data privacy laws passed to date, the Oregon Consumer Privacy Act (OCPA) includes provisions on biometric data, sensitive and personal data, and children’s data protections, and it doesn’t have the same exemptions found in other state privacy laws. OCPA has made Oregon the eleventh state to pass comprehensive privacy legislation – the sixth in 2023 – and the bill is effective July 1, 2024. Passed with bipartisan support, the Tennessee Information Protection Act enables consumers to confirm that a business has collected their personal data, obtain a copy of the information, and request that inaccuracies be corrected. This law makes Tennessee the eighth state to sign comprehensive data privacy into law, and it is effective July 1, 2025. Texas is the second-largest state after California to enact comprehensive privacy laws, giving residents more control over their personal data. Effective July 1, 2024, the Texas Data Privacy and Security Act (TDPSA) will apply to large companies that do business in Texas or sell, collect, or process personal data. Small businesses will mostly be exempt. On March 24, 2022, Utah became the fourth state to pass comprehensive data legislation. The Utah Consumer Privacy Act (UCPA) – which takes a business-friendly approach to consumer protection – took effect on Dec. 31, 2023. On March 21, 2021, Virginia became the second state to pass comprehensive data privacy legislation with the enactment of Virginia Consumer Data Protection Act (VCDPA). The law went into effect on Jan. 1, 2023, and it gives Virginians the right to access their data and request that their personal information be deleted by businesses. It also requires companies to conduct data protection assessments to process personal data for targeted advertising and sales purposes. Across the globe, 137 out of 194 countries have enacted legislation to protect data and privacy. Bloomberg’s State and International Chart Builders – which simplify compliance by providing quick reference comparisons of statutory and regulatory requirements across jurisdictions – give subscribers a snapshot of these varying rules and regulations. The GDPR establishes a single EU-wide data protection law that is intended to strengthen consumer data protection rights and the obligations of those who process and determine the processing of personal data. The GDPR provides EU citizens with specific rights regarding the use and storage of their personal data and applies to any entity in the EU that processes such data. China’s Personal Information Protection Law (PIPL), which went into effect on Nov. 1, 2021, is a crucial international privacy and data security law. PIPL is the first national law to comprehensively regulate personal information (PI) protection problems. PIPL governs the processing of PI within the People’s Republic of China. However, like the GDPR, the law has extraterritorial reach to organizations outside the country, and allows individuals the right to decide, limit, or object to the use of their PI. The rapidly changing landscape of consumer data privacy laws and regulations across the globe can make it difficult for organizations to stay up to date with the requirements that apply to them. Bloomberg Law provides comprehensive resources to handle multifaceted regulatory and compliance initiatives. Our expert analysis and practice tools help you stay current with the latest developments and navigate the complex patchwork of legal and regulatory requirements at the state, federal, and international levels. Download our GC Guide to Navigating 2024: Data Privacy and Cybersecurity Risk for analysis of the most pressing data privacy and cybersecurity challenges facing in-house counsel, from AI regulations to child online privacy laws. Ready to get started? Request a demo to take a tour of Bloomberg Law and see our consumer data privacy resources in action. See Bloomberg Law in action From live events to in-depth reports, discover singular thought leadership from Bloomberg Law. Our network of expert analysts is always on the case – so you can make yours. Request a demo to see it for yourself. © 2024 Bloomberg Industry Group, Inc. All rights reserved.